{
  "finding_id": "DF-4244",
  "status": "untested",
  "reproduced": 0,
  "impact": "none demonstrated on guest (no DPT hardware); source-level impact: device-fed bound \u2192 OOB kernel read up to ~65KB past the 512-byte DMA buffer at attach (DoS ceiling, no disclosure)",
  "confidence": "certain",
  "verdict": "Untested at kernel level (no DPT hardware; no QEMU emulation). Walk arithmetic proven on the guest with the verbatim macros: with a device-fed length of 65539 the loop accepts pointers to buff+65536 while only 512 bytes were DMAd \u2014 15361 iterations read past the entire sg page. Bound should be the transfer size, not the device-fed header length.",
  "exploit_chain": "",
  "evidence": "run.log (DF-4244 block); dpt_scsi.c:618,648,663-669; dpt.h:341-344",
  "kernel_refs": [
    "sys/dev/raid/dpt/dpt_scsi.c:618",
    "sys/dev/raid/dpt/dpt_scsi.c:648",
    "sys/dev/raid/dpt/dpt_scsi.c:663",
    "sys/dev/raid/dpt/dpt_scsi.c:665",
    "sys/dev/raid/dpt/dpt.h:341",
    "sys/dev/raid/dpt/dpt.h:343"
  ],
  "poc_changes": "No seed PoC existed; evidence authored from scratch in this run.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o dpt_df4244_walk dpt_df4244_walk.c",
  "run_cmd": "./dpt_df4244_walk",
  "code_hash": "cdb3a06153a4a307936dee534135cee9832bd852318d3e6a30537ac32c29ac2f",
  "notes": "Device-fed config/log-page walk family (prompt item d/f). Attach-time, Low severity.",
  "recommended_fix": "Clamp bytes to the 512 bytes actually DMAd before the walk (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree; kernel-level fix validation impossible without DPT SmartRAID hardware (none in guest, no QEMU emulation exists).",
  "fix_evidence": "fix.diff"
}